[PATCH 0/1] MR1778: dwrite: Handle memory allocation failure in bidi_compute_bracket_pairs (cppcheck).

[PATCH 1/1] dwrite: Handle memory allocation failure in bidi_compute_bracket_pairs (cppcheck).

[Alex Henrie]

From: Alex Henrie

---
 dlls/dwrite/bidi.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/dlls/dwrite/bidi.c b/dlls/dwrite/bidi.c
index 142c82f19d0..2a0c22b4948 100644
--- a/dlls/dwrite/bidi.c
+++ b/dlls/dwrite/bidi.c
@@ -632,12 +632,14 @@ static BracketPair *bidi_compute_bracket_pairs(IsolatedRun *iso_run)
     WCHAR *open_stack;
     int *stack_index;
     int stack_top = iso_run->length;
-    BracketPair *out = NULL;
+    BracketPair *out = NULL, *new_out;
     int pair_count = 0;
     int i;

open_stack = malloc(sizeof(WCHAR) * iso_run->length);
+    if (!open_stack) return NULL;
     stack_index = malloc(sizeof(int) * iso_run->length);
+    if (!stack_index) goto done;

for (i = 0; i < iso_run->length; i++) {
         unsigned short ubv = get_table_entry_16(bidi_bracket_table, iso_run->item[i].ch);
@@ -646,6 +648,7 @@ static BracketPair *bidi_compute_bracket_pairs(IsolatedRun *iso_run)
             if (!out)
             {
                 out = malloc(sizeof(BracketPair));
+                if (!out) break;
                 out[0].start = -1;
             }

@@ -668,7 +671,12 @@ static BracketPair *bidi_compute_bracket_pairs(IsolatedRun *iso_run)
                         out[pair_count].start = stack_index[j];
                         out[pair_count].end = i;
                         pair_count++;
-                        out = realloc(out, sizeof(BracketPair) * (pair_count+1));
+                        new_out = realloc(out, sizeof(BracketPair) * (pair_count + 1));
+                        if (!new_out) {
+                            pair_count = 0;
+                            goto done;
+                        }
+                        out = new_out;
                         out[pair_count].start = -1;
                         stack_top = j+1;
                         break;
@@ -677,6 +685,7 @@ static BracketPair *bidi_compute_bracket_pairs(IsolatedRun *iso_run)
             }
         }
     }
+done:
     if (pair_count == 0)
     {
         free(out);

[Nikolay Sivov (＠nsivov)]

I think it's better to simply over-allocate pairs array once.